Computer networks typically provide a physical interconnection between different computers to allow convenient exchange of programs and data. A plurality of connectivity devices, such as switches and routers, interconnect each user computer connected to the network. The connectivity devices maintain routing information about the computers and perform routing decisions concerning message traffic passed between the computers via the connectivity devices. Each connectivity device, or router, corresponds to a network routing prefix indicative of the other computers, which it has direct, or indirect access to. Therefore, data routed from one computer to another follows a path through the network defined by the routers between the two computers.
The routers define nodes in a network, and data travels between the nodes in a series of so-called “hops” over the network. Since each router is typically connected to multiple other routers, there may be multiple potential paths between given computers. Typically, the routing information is employed in a routing table in each router, which is used to determine a path to a destination computer or network. The router makes a routing decision, using the routing table, to identify the next “hop,” or next router, to send the data to in order for it to ultimately reach the destination computer.
A Virtual Private Network (VPN) is a network that uses a public telecommunication infrastructure, such as the Internet, to provide remote offices or individual users with secure access to their organization's network. A VPN works by using the shared public infrastructure while maintaining privacy through security procedures and tunneling protocols.
VPNs provide a secured means for transmitting and receiving data between network nodes even though a corresponding physical network supporting propagation of the data is shared by many users. Typically, the data transmitted between such network nodes (e.g., edge nodes of a service provider network) is encrypted to protect against eavesdropping and tampering by unauthorized parties.
One type of VPN is known as a 2547 based VPN, which allow a customer to offer VPN service using the notion of a Virtual Routing and Forwarding (VRF) instance. PE routers typically maintain VRF information in a table (a VRF table) dictating how to route and forward traffic through the shared physical network to support corresponding VPNs for the different customers. In 2547 VPNs, PE routers advertise VPN prefixes and labels (VPN_LABEL) for these prefixes using Multi-Protocol Border Gateway Protocol (MP-BGP) in the control plane. In the forwarding plane, when an IP packet arrives into a VRF, the packet is appended with two labels (e.g., an Internal Gateway Protocol label (IGP_LABEL) and a VPN_LABEL). The IGP_LABEL gets the packet to the far end PE. The VPN_LABEL associates the packet with the outgoing interface on the far end PE. 2547 VPNs inherently allow for “any2any” connectivity for a scalable VPN solution to connect thousands of sites. Many large enterprises are using 2547 VPNs for segmentation.
Another type of VPN is known as a Dynamic Multipoint VPN (DMVPN). DMVPN allows users to better scale large and small Internet Protocol Security (IPSec) VPNs by combining Generic Routing Encapsulation (GRE) tunnels, IPSec encryption, and Next Hop Resolution Protocol (NHRP) to provide users with easy configuration through cryptogrpahic profiles, which override the requirement for defining static cryptographic maps, and dynamic discovery of tunnel endpoints. NHRP is a client and server protocol where the hub is the server and the spokes are the clients.
In a DMVPN environment, each spoke has a permanent IPSec tunnel to a hub, but not to the other spokes within the network. Each spoke registers as clients of the NHRP server. The hub maintains an NHRP database of the public interface addresses of the each spoke. Each spoke registers its real address when it boots and queries the NHRP database for real addresses of the destination spokes in order to build direct tunnels.
When a spoke needs to send a packet to a destination (private) subnet on another spoke, it queries the NHRP server for the real (outside) address of the destination (target) spoke. After the originating spoke learns the peer address of the target spoke, it can initiate a dynamic IPSec tunnel to the target spoke. The spoke-to-spoke tunnel is built over the multipoint GRE (mGRE) interface. mGRE Tunnel Interfaces allow a single GRE interface to support multiple IPSec tunnels and therefore simplifies the size and complexity of the configuration.
The spoke-to-spoke links are established on demand whenever there is traffic between the spokes. Thereafter, packets are able to bypass the hub and use the spoke-to-spoke tunnel.